Skip to content

Commit 91557c8

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request Azure#13137 from CrashCringle12/CrashCringle12-abuseipdb-fixes
Fix Typos and Update Img Source in AbuseIPDB Playbook Solutions
2 parents af5f8da + 29568e9 commit 91557c8

File tree

13 files changed

+77
-77
lines changed

13 files changed

+77
-77
lines changed

‎Solutions/AbuseIPDB/Data/Solution_AbuseIPDB.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66
"Playbooks": [
77
"Solutions/AbuseIPDB/Playbooks/AbuseIPDBAPIConnector/azuredeploy.json",
88
"Solutions/AbuseIPDB/Playbooks/AbuseIPDB-EnrichIncidentByIPInfo/azuredeploy.json",
9-
"Solutions/AbuseIPDB/Playbooks/AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams/azuredeploy.json",
9+
"Solutions/AbuseIPDB/Playbooks/AbuseIPDB-ReportIPsAfterUserResponseInMSTeams/azuredeploy.json",
1010
"Solutions/AbuseIPDB/Playbooks/AbuseIPDB-BlacklistIpToThreatIntelligence/azuredeploy.json"
1111
],
1212
"BasePath": "C:\\GitHub\\Azure-Sentinel",
13-
"Version": "3.0.1",
13+
"Version": "3.0.2",
1414
"Metadata": "SolutionMetadata.json",
1515
"TemplateSpec": true,
1616
"Is1PConnector": false

‎Solutions/AbuseIPDB/Data/system_generated_metadata.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,6 @@
3030
"Playbooks/AbuseIPDBAPIConnector/azuredeploy.json",
3131
"Playbooks/AbuseIPDB-BlacklistIpToThreatIntelligence/azuredeploy.json",
3232
"Playbooks/AbuseIPDB-EnrichIncidentByIPInfo/azuredeploy.json",
33-
"Playbooks/AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams/azuredeploy.json"
33+
"Playbooks/AbuseIPDB-ReportIPsAfterUserResponseInMSTeams/azuredeploy.json"
3434
]
3535
}

‎Solutions/AbuseIPDB/Package/3.0.2.zip‎

26.5 KB
Binary file not shown.

‎Solutions/AbuseIPDB/Package/mainTemplate.json‎

Lines changed: 35 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
"email": "[email protected]",
3434
"_email": "[variables('email')]",
3535
"_solutionName": "AbuseIPDB",
36-
"_solutionVersion": "3.0.1",
36+
"_solutionVersion": "3.0.2",
3737
"solutionId": "azuresentinel.azure-sentinel-solution-abuseipdb",
3838
"_solutionId": "[variables('solutionId')]",
3939
"AbuseIPDBAPIConnector": "AbuseIPDBAPIConnector",
@@ -54,10 +54,10 @@
5454
"playbookId2": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId2'))]",
5555
"playbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId2'))))]",
5656
"_playbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId2'),'-', variables('playbookVersion2'))))]",
57-
"AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams": "AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams",
58-
"_AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams": "[variables('AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams')]",
57+
"AbuseIPDB-ReportIPsAfterUserResponseInMSTeams": "AbuseIPDB-ReportIPsAfterUserResponseInMSTeams",
58+
"_AbuseIPDB-ReportIPsAfterUserResponseInMSTeams": "[variables('AbuseIPDB-ReportIPsAfterUserResponseInMSTeams')]",
5959
"playbookVersion3": "1.0",
60-
"playbookContentId3": "AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams",
60+
"playbookContentId3": "AbuseIPDB-ReportIPsAfterUserResponseInMSTeams",
6161
"_playbookContentId3": "[variables('playbookContentId3')]",
6262
"playbookId3": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId3'))]",
6363
"playbookTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId3'))))]",
@@ -82,7 +82,7 @@
8282
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
8383
],
8484
"properties": {
85-
"description": "AbuseIPDBAPIConnector Playbook with template version 3.0.1",
85+
"description": "AbuseIPDBAPIConnector Playbook with template version 3.0.2",
8686
"mainTemplate": {
8787
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
8888
"contentVersion": "[variables('playbookVersion1')]",
@@ -640,7 +640,7 @@
640640
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
641641
],
642642
"properties": {
643-
"description": "AbuseIPDB-EnrichIncidentByIPInfo Playbook with template version 3.0.1",
643+
"description": "AbuseIPDB-EnrichIncidentByIPInfo Playbook with template version 3.0.2",
644644
"mainTemplate": {
645645
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
646646
"contentVersion": "[variables('playbookVersion2')]",
@@ -735,27 +735,27 @@
735735
"inputs": {
736736
"name": "Result List",
737737
"value": {
738-
"abuseConfidenceScore": "@body('AuseIPDB_CHECK_Endpoint')?['data']?['abuseConfidenceScore']",
739-
"hostnames": "@body('AuseIPDB_CHECK_Endpoint')?['data']?['hostnames']",
740-
"ipAddress": "@body('AuseIPDB_CHECK_Endpoint')?['data']?['ipAddress']",
741-
"ipVersion": "@body('AuseIPDB_CHECK_Endpoint')?['data']?['ipVersion']",
742-
"isPublic": "@body('AuseIPDB_CHECK_Endpoint')?['data']?['isPublic']",
743-
"isWhitelisted": "@body('AuseIPDB_CHECK_Endpoint')?['data']?['isWhitelisted']",
744-
"isp": "@body('AuseIPDB_CHECK_Endpoint')?['data']?['isp']",
745-
"lastReportedAt": "@body('AuseIPDB_CHECK_Endpoint')?['data']?['lastReportedAt']",
746-
"numDistinctUsers": "@body('AuseIPDB_CHECK_Endpoint')?['data']?['numDistinctUsers']",
747-
"totalReports": "@body('AuseIPDB_CHECK_Endpoint')?['data']?['totalReports']",
748-
"usageType": "@body('AuseIPDB_CHECK_Endpoint')?['data']?['usageType']"
738+
"abuseConfidenceScore": "@body('AbuseIPDB_CHECK_Endpoint')?['data']?['abuseConfidenceScore']",
739+
"hostnames": "@body('AbuseIPDB_CHECK_Endpoint')?['data']?['hostnames']",
740+
"ipAddress": "@body('AbuseIPDB_CHECK_Endpoint')?['data']?['ipAddress']",
741+
"ipVersion": "@body('AbuseIPDB_CHECK_Endpoint')?['data']?['ipVersion']",
742+
"isPublic": "@body('AbuseIPDB_CHECK_Endpoint')?['data']?['isPublic']",
743+
"isWhitelisted": "@body('AbuseIPDB_CHECK_Endpoint')?['data']?['isWhitelisted']",
744+
"isp": "@body('AbuseIPDB_CHECK_Endpoint')?['data']?['isp']",
745+
"lastReportedAt": "@body('AbuseIPDB_CHECK_Endpoint')?['data']?['lastReportedAt']",
746+
"numDistinctUsers": "@body('AbuseIPDB_CHECK_Endpoint')?['data']?['numDistinctUsers']",
747+
"totalReports": "@body('AbuseIPDB_CHECK_Endpoint')?['data']?['totalReports']",
748+
"usageType": "@body('AbuseIPDB_CHECK_Endpoint')?['data']?['usageType']"
749749
}
750750
},
751751
"runAfter": {
752-
"AuseIPDB_CHECK_Endpoint": [
752+
"AbuseIPDB_CHECK_Endpoint": [
753753
"Succeeded"
754754
]
755755
},
756756
"type": "AppendToArrayVariable"
757757
},
758-
"AuseIPDB_CHECK_Endpoint": {
758+
"AbuseIPDB_CHECK_Endpoint": {
759759
"inputs": {
760760
"host": {
761761
"connection": {
@@ -814,7 +814,7 @@
814814
"type": "ApiConnection"
815815
},
816816
"Get_Logo": {
817-
"inputs": "<img src=\"https://www.abuseipdb.com/img/abuseipdb.png.pagespeed.ce.CI8T6WsXU7.png\" width=\"152\" height=\"32\"> ",
817+
"inputs": "<img src=\"https://www.abuseipdb.com/img/abuseipdb.png\" width=\"152\" height=\"32\"> ",
818818
"runAfter": {
819819
"Entities_-_Get_IPs": [
820820
"Succeeded"
@@ -974,14 +974,14 @@
974974
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
975975
],
976976
"properties": {
977-
"description": "AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams Playbook with template version 3.0.1",
977+
"description": "AbuseIPDB-ReportIPsAfterUserResponseInMSTeams Playbook with template version 3.0.2",
978978
"mainTemplate": {
979979
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
980980
"contentVersion": "[variables('playbookVersion3')]",
981981
"parameters": {
982982
"PlaybookName": {
983-
"defaultValue": "AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams",
984-
"type": "String"
983+
"defaultValue": "AbuseIPDB-ReportIPsAfterUserResponseInMSTeams",
984+
"type": "string"
985985
},
986986
"customApis_AbuseIPDBAPI_name": {
987987
"defaultValue": "AbuseIPDBAPI",
@@ -992,16 +992,16 @@
992992
},
993993
"MSTeamsGroupId": {
994994
"defaultValue": "<MSTeamsGroupId>",
995-
"type": "String",
995+
"type": "string",
996996
"metadata": {
997-
"description": "Value of the MSTeamsGroupId parameter in the AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams playbook. Id of the Teams Group where the adaptive card will be posted."
997+
"description": "Value of the MSTeamsGroupId parameter in the AbuseIPDB-ReportIPsAfterUserResponseInMSTeams playbook. Id of the Teams Group where the adaptive card will be posted."
998998
}
999999
},
10001000
"MSTeamsChannelId": {
10011001
"defaultValue": "<MSTeamsChannelId>",
1002-
"type": "String",
1002+
"type": "string",
10031003
"metadata": {
1004-
"description": "Value of the MSTeamsChannelId parameter in the AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams playbook. Id of the Teams Channel where the adaptive card will be posted."
1004+
"description": "Value of the MSTeamsChannelId parameter in the AbuseIPDB-ReportIPsAfterUserResponseInMSTeams playbook. Id of the Teams Channel where the adaptive card will be posted."
10051005
}
10061006
}
10071007
},
@@ -1340,7 +1340,7 @@
13401340
"type": "Foreach"
13411341
},
13421342
"Get_Logo": {
1343-
"inputs": "<img src=\"https://www.abuseipdb.com/img/abuseipdb.png.pagespeed.ce.CI8T6WsXU7.png\" width=\"152\" height=\"32\"> ",
1343+
"inputs": "<img src=\"https://www.abuseipdb.com/img/abuseipdb.png\" width=\"152\" height=\"32\"> ",
13441344
"runAfter": {
13451345
"Entities_-_Get_IPs": [
13461346
"Succeeded"
@@ -1469,7 +1469,7 @@
14691469
}
14701470
],
14711471
"metadata": {
1472-
"title": " AbuseIPDB Report a IPs To AbuselPDB After Checking By User In MSTeams",
1472+
"title": "AbuseIPDB Report IPs To AbuseIPDB After User Response In MSTeams",
14731473
"description": "When a new sentinel incident is created, this playbook gets triggered and performs the following actions:\n 1. Sends an adaptive card to the Teams channel where the analyst can choose an action to be taken.",
14741474
"prerequisites": [
14751475
"1. Prior to the deployment of this playbook, AbuseIPDB Connector needs to be deployed under the same subscription.",
@@ -1495,7 +1495,7 @@
14951495
"releaseNotes": [
14961496
{
14971497
"version": "1.0.0",
1498-
"title": "AbuseIPDB Report a IPs To AbuselPDB After Checking By User In MSTeams",
1498+
"title": "AbuseIPDB Report IPs To AbuseIPDB After User Response In MSTeams",
14991499
"notes": [
15001500
"Initial version"
15011501
]
@@ -1510,7 +1510,7 @@
15101510
"contentSchemaVersion": "3.0.0",
15111511
"contentId": "[variables('_playbookContentId3')]",
15121512
"contentKind": "Playbook",
1513-
"displayName": "AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams",
1513+
"displayName": "AbuseIPDB-ReportIPsAfterUserResponseInMSTeams",
15141514
"contentProductId": "[variables('_playbookcontentProductId3')]",
15151515
"id": "[variables('_playbookcontentProductId3')]",
15161516
"version": "[variables('playbookVersion3')]"
@@ -1525,7 +1525,7 @@
15251525
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
15261526
],
15271527
"properties": {
1528-
"description": "AbuseIPDB-BlacklistIpToThreatIntelligence Playbook with template version 3.0.1",
1528+
"description": "AbuseIPDB-BlacklistIpToThreatIntelligence Playbook with template version 3.0.2",
15291529
"mainTemplate": {
15301530
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
15311531
"contentVersion": "[variables('playbookVersion4')]",
@@ -1830,8 +1830,7 @@
18301830
"prerequisites": [
18311831
"1. AbuseIPDBAPI Custom Connector has to be deployed prior to the deployment of this playbook under the same subscription.",
18321832
"2. To use the Microsoft Graph Security connector actions, Microsoft Entra ID tenant administrator consent needs to be provided. The Microsoft Graph Security connector application ID and name for Microsoft Entra ID follows for Microsoft Entra ID administrator consent:\n- Application Name - MicrosoftGraphSecurityConnector\n- Application ID - c4829704-0edc-4c3d-a347-7c4a67586f3c",
1833-
1834-
"3. To view the Threat Indicators submitted by Microsoft Graph Security connector, 'Threat Intelligence Platforms' connector from 'Threat Intelligence' Solution need to be install."
1833+
"3. To view the Threat Indicators submitted by Microsoft Graph Security connector, 'Threat Intelligence Platforms' connector from 'Threat Intelligence' Solution need to be install."
18351834
],
18361835
"preDeployment": [
18371836
"1. AbuseIPDB Custom Connector has to be deployed prior to the deployment of this playbook under the same subscription."
@@ -1881,7 +1880,7 @@
18811880
"apiVersion": "2023-04-01-preview",
18821881
"location": "[parameters('workspace-location')]",
18831882
"properties": {
1884-
"version": "3.0.1",
1883+
"version": "3.0.2",
18851884
"kind": "Solution",
18861885
"contentSchemaVersion": "3.0.0",
18871886
"displayName": "AbuseIPDB",
@@ -1923,7 +1922,7 @@
19231922
},
19241923
{
19251924
"kind": "Playbook",
1926-
"contentId": "[variables('_AbuseIPDB-ReportaIPsToAbuselPDBAfterCheckingByUserInMSTeams')]",
1925+
"contentId": "[variables('_AbuseIPDB-ReportIPsAfterUserResponseInMSTeams')]",
19271926
"version": "[variables('playbookVersion3')]"
19281927
},
19291928
{

‎Solutions/AbuseIPDB/Playbooks/AbuseIPDB-EnrichIncidentByIPInfo/azuredeploy.json‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -130,27 +130,27 @@
130130
"inputs":{
131131
"name":"Result List",
132132
"value":{
133-
"abuseConfidenceScore":"@body('AuseIPDB_CHECK_Endpoint')?['data']?['abuseConfidenceScore']",
134-
"hostnames":"@body('AuseIPDB_CHECK_Endpoint')?['data']?['hostnames']",
135-
"ipAddress":"@body('AuseIPDB_CHECK_Endpoint')?['data']?['ipAddress']",
136-
"ipVersion":"@body('AuseIPDB_CHECK_Endpoint')?['data']?['ipVersion']",
137-
"isPublic":"@body('AuseIPDB_CHECK_Endpoint')?['data']?['isPublic']",
138-
"isWhitelisted":"@body('AuseIPDB_CHECK_Endpoint')?['data']?['isWhitelisted']",
139-
"isp":"@body('AuseIPDB_CHECK_Endpoint')?['data']?['isp']",
140-
"lastReportedAt":"@body('AuseIPDB_CHECK_Endpoint')?['data']?['lastReportedAt']",
141-
"numDistinctUsers":"@body('AuseIPDB_CHECK_Endpoint')?['data']?['numDistinctUsers']",
142-
"totalReports":"@body('AuseIPDB_CHECK_Endpoint')?['data']?['totalReports']",
143-
"usageType":"@body('AuseIPDB_CHECK_Endpoint')?['data']?['usageType']"
133+
"abuseConfidenceScore":"@body('AbuseIPDB_CHECK_Endpoint')?['data']?['abuseConfidenceScore']",
134+
"hostnames":"@body('AbuseIPDB_CHECK_Endpoint')?['data']?['hostnames']",
135+
"ipAddress":"@body('AbuseIPDB_CHECK_Endpoint')?['data']?['ipAddress']",
136+
"ipVersion":"@body('AbuseIPDB_CHECK_Endpoint')?['data']?['ipVersion']",
137+
"isPublic":"@body('AbuseIPDB_CHECK_Endpoint')?['data']?['isPublic']",
138+
"isWhitelisted":"@body('AbuseIPDB_CHECK_Endpoint')?['data']?['isWhitelisted']",
139+
"isp":"@body('AbuseIPDB_CHECK_Endpoint')?['data']?['isp']",
140+
"lastReportedAt":"@body('AbuseIPDB_CHECK_Endpoint')?['data']?['lastReportedAt']",
141+
"numDistinctUsers":"@body('AbuseIPDB_CHECK_Endpoint')?['data']?['numDistinctUsers']",
142+
"totalReports":"@body('AbuseIPDB_CHECK_Endpoint')?['data']?['totalReports']",
143+
"usageType":"@body('AbuseIPDB_CHECK_Endpoint')?['data']?['usageType']"
144144
}
145145
},
146146
"runAfter":{
147-
"AuseIPDB_CHECK_Endpoint":[
147+
"AbuseIPDB_CHECK_Endpoint":[
148148
"Succeeded"
149149
]
150150
},
151151
"type":"AppendToArrayVariable"
152152
},
153-
"AuseIPDB_CHECK_Endpoint":{
153+
"AbuseIPDB_CHECK_Endpoint":{
154154
"inputs":{
155155
"host":{
156156
"connection":{
@@ -215,7 +215,7 @@
215215
"type":"ApiConnection"
216216
},
217217
"Get_Logo":{
218-
"inputs":"<img src=\"https://www.abuseipdb.com/img/abuseipdb.png.pagespeed.ce.CI8T6WsXU7.png\" width=\"152\" height=\"32\"> ",
218+
"inputs":"<img src=\"https://www.abuseipdb.com/img/abuseipdb.png\" width=\"152\" height=\"32\"> ",
219219
"runAfter":{
220220
"Entities_-_Get_IPs":[
221221
"Succeeded"
@@ -288,4 +288,4 @@
288288
}
289289
}
290290
]
291-
}
291+
}

0 commit comments

Comments
 (0)